Bypassing Windows authentication reflection mitigations for ...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://www.synacktiv.com/en/publications/bypassing-windows-authentication-reflection-mitigations-for-system-shells-part.html
• Blog Title: Bypassing Windows authentication reflection mitigations for SYSTEM shells - Part 2
• Suggested Section: Windows Hardening -> Active Directory Methodology (new page under Kerberos Authentication or NTLM/Relay area): "Kerberos reflection/relay via Unicode normalization (LCMapStringEx/NTDS SPN collisions)"; cross-link from "Spoofing LLMNR, NBT-NS, mDNS/DNS and WPAD and Relay Attacks" and Kerberos sections

🎯 Content Summary

Title / context
Synacktiv (Part 2) develops a novel Kerberos authentication coercion primitive that bypassed Microsoft’s post-CVE-2025-33073 “authentication reflection” mitigations. The core bug class is Unicode normalization inconsistencies across Windows components: some pieces consider two strings “equivalent” (or generate colliding database search keys), while others treat them as different—allowing Kerberos reflection/relay that yields RCE as NT AUT...

🔧 Technical Details

1. Unicode-based Kerberos reflection primitive via inconsistent normalization: Craft a target hostname/FQDN that (a) is treated as different from the local machine name by client-side checks (so DnsCache issues a DNS request), yet (b) collides with the victim’s real SPN during DC lookup because NTDS/ESE search keys are derived from LCMapStringEx(LCMAP_SORTKEY, flags=0x31403). Use Unicode lookalikes (e.g., replace R with �, bytes 24 C7) and Unicode dot equivalents (e.g., �, bytes 20 24) to build names like S�V1�AD�LOCAL. Register the name in DNS (via LDAP), coerce Kerberos auth (e.g., PetitPotam), capture the AP-REQ on a relay server, and relay it back to a service on the victim. A relay implementation may require relaxing strict string matching (patching krbrelayx.py) because the received SPN may contain Unicode characters.
   
   2) Handling DNS re...

🤖 Agent Actions

I’m mapping the existing Windows AD and relay content first, then I’ll read the closest pages to determine whether this belongs in an existing NTLM/Kerberos relay file or needs a new page.
I’ve narrowed it to the AD methodology and relay sections. Next I’m reading the existing Kerberos, DNS, relay, ADCS, and SCCM pages to avoid duplicating material and to pick a single target file.
I’ve confirmed the closest fit is the existing Kerberos relay section in the relay methodology page, not a new AD page. I’m doing one quick external check for canonical source URLs before writing the update.
I’ve verified the technique is missing and I’m adding it to the existing Kerberos relay section as a focused subsection. The update will cover the Unicode normalization primitive, DNS/SPN collision constraints, the local-forwarder LPE variant, and the non-SMB relay targets that still matter.
The content is in place. I found the Synacktiv reference URL I first inserted was wrong, so I’m correcting that and then I’ll do a final diff/readback check.
Updated spoofing-llmnr-nbt-ns-mdns-dns-and-wpad-and-relay-attacks.md in the existing Kerberos Relay attack section instead of creating a new page.

The new subsection documents the Unicode-normalization Kerberos reflection primitive from Synacktiv: how CompareStringW and LCMapStringEx(..., 0x31403) disagree, why ADIDNS uniqueness checks constrain hostname-only variants, how the FQDN-based collision is used for coercion and relay, how the SMB mitigation changed it into a local-forwarder LPE path, and why AD CS / SCCM AdminService remain relevant non-SMB targets. I also added the required references at the end of the file, including the Synacktiv article and the Microsoft docs for LCMapStringEx and CompareStringW.

Verification: I re-read the modified section, checked the git diff, confirmed the references section is still at the end of the file, and validated the Synacktiv URL returns HTTP 200.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://www.synacktiv.com/en/publications/bypassing-windows-authentication-reflection-mitigations-for-system-shells-part.html

Content Categories: Based on the analysis, this content was categorized under "Windows Hardening -> Active Directory Methodology (new page under Kerberos Authentication or NTLM/Relay area): "Kerberos reflection/relay via Unicode normalization (LCMapStringEx/NTDS SPN collisions)"; cross-link from "Spoofing LLMNR, NBT-NS, mDNS/DNS and WPAD and Relay Attacks" and Kerberos sections".

Repository Maintenance:

• MD Files Formatting: 972 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0